You can never know how a security incident will unfold. With that in mind, in the detection and analysis phase, we didn't try to enumerate every possible scenario. Instead, we listed common events that we see as major concerns. These include malware infestations, phishing attacks, unauthorized access, data loss, denial-of-service attacks and theft. We are also defining which sorts of events should trigger activation of the CAT. For example, a single PC hit by malware is insufficient, but the detection of malware that's quickly propagating could well require a full CAT response. To help us decide when the cavalry is needed, we are creating a matrix to lay out the criteria for escalation.
For the third phase, containment and eradication, we are establishing guidelines on whether an event requires evidence collection, damage assessment and identification of the attackers. We are also preparing checklists to help ensure proper eradication and containment of whatever malicious activity the incident involves. For example, a checklist might address what to do when a Windows server is compromised.
For the post-incident phase, we are describing how to ensure that we have gathered all the information necessary for criminal or administrative action, and we are including recommendations on post-mortems so we can identify what went well and what needs improvement.
Once the incident-response process document is complete, we'll start scheduling training sessions and then regular testing of the plan so we can maintain confidence that we are able to effectively respond to any incident.
This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at email@example.com.
Join in the discussions about security! computerworld.com/blogs/security
Read more about security in Computerworld's Security Topic Center.